Vendor Chain Audit · $490 one-off
Your vendor chain to tier 3, checked, for $490
A one-off Vendor Chain Audit. Every row is checked against the vendor's own published list, AI subprocessors are flagged, and you get the chain evidence EDPB Opinion 22/2024 expects you to have to hand.
What the $490 covers
- Up to 25 direct vendors, tiers 1 to 3. Your vendors (tier 1), their subprocessors (tier 2), and the subprocessors' own subprocessors (tier 3), wherever those are published.
- Evidence on every row. A link to the vendor's own published list and the date we checked it. Where we used Third Party Index data, the row says so and links to it.
- AI subprocessor flags. Model providers, inference hosts and AI agent services, with the vendor's purpose wording, so you can see why each was flagged.
- EDPB 22/2024 chain evidence. For each processor and sub-processor: name, address and contact details where the vendor publishes them. Gaps are listed, not filled in.
- Gaps you can act on. Vendors with no published list, or entries we couldn't verify, are marked with the date we looked.
- Delivered by email within 10 business days of having both your vendor list and payment, in two files: a PDF summary for your auditor or board, and a CSV of every vendor-to-subprocessor row with its source URL and the date we checked it. If we deliver late, we refund the fee.
- More vendors? Each extra block of 25 direct vendors is quoted separately before you pay.
The EDPB means the whole chain
EDPB Opinion 22/2024 says controllers should have "the information on the identity (i.e. name, address, contact person) of all processors, sub-processors etc. readily available at all times", regardless of the risk of the processing. EDPB, October 2024 A vendor's own list stops at tier 2. The audit takes it a tier further and shows its sources.
Why pay when Third Party Index is free?
Third Party Index is a good free index, and we use some of its data with credit. It publishes what vendors declare. Its DORA export says "Ranks 1 and 2 only." and "Check each row against the vendor's list before it goes in a register." source
| Third Party Index (free) | Vendor Chain Audit ($490) | |
|---|---|---|
| Depth | Declared lists; DORA export ranks 1 and 2 | Tiers 1 to 3 |
| Row status | Candidate, to check yourself | Checked against the vendor's own list, dated |
| AI flags | Flags 22 named AI model providers (its /ai page) | Model providers, inference hosts and AI agent services, with the vendor's wording |
| Output | Web pages, CSV, feeds | Your chain as one deliverable, with gaps listed |
Comparison as observed on thirdpartyindex.com on 19-20 Oct 2026. Re-check before publishing.
| Subprocessor | Purpose | AI |
|---|---|---|
| Anthropic, PBC | AI model provider | flagged |
| OpenAI OpCo, LLC | AI model provider | flagged |
Who it's for
- In-house privacy, security or procurement teams answering a customer questionnaire, a DPA review or an audit.
- Teams in DORA scope who need the subcontracting chain past rank 2.
- Fractional DPO and vCISO firms who want to try us on one client before the monthly pilot.
How it works
- Ask a question (or see the sample audit first). We confirm your list of up to 25 direct vendors before you pay. Then use the Pay button: it opens a short invoice request until card payment is live.Pay $490
Opens a short invoice request. We confirm your list of up to 25 direct vendors by email, then send the invoice. The 10-business-day clock starts once we have both your vendor list and payment.
- Send your vendor list: a spreadsheet, or a link to your own published subprocessor page.
- We map and check by hand, and email you the PDF summary and CSV within 10 business days of having both your vendor list and payment.
Monitoring is not included. If you want alerts when a list in your chain changes, that's a separate $99/month for up to 100 vendors, only if you want it later.
What it isn't
Not legal advice and not a contract review. It maps what vendors publish; your DPO or counsel decides what to do with it.
FAQ
What is a Vendor Chain Audit?
A Vendor Chain Audit is a one-off, $490 USD service from subprocessors.fyi. We map up to 25 of one company's direct vendors and their subprocessors from tier 1 to tier 3, check each row against the vendor's own published list, flag AI subprocessors, and deliver the chain within 10 business days as a PDF summary plus a CSV with a source URL and check date for every row.
How many vendors does the $490 audit cover?
The $490 USD Vendor Chain Audit covers up to 25 direct vendors, each mapped to tier 3. If you have more, each extra block of 25 direct vendors is quoted separately before you pay.
How long does the audit take?
We deliver the Vendor Chain Audit within 10 business days, counted from when we have both your vendor list and your payment. You get a PDF summary for your auditor or board and a CSV of every vendor-to-subprocessor row with its source URL and check date. If we deliver late, we refund the $490 USD fee.
What does EDPB Opinion 22/2024 say about sub-processors?
EDPB Opinion 22/2024, adopted in October 2024, says controllers should have information on the identity (name, address, contact person) of all processors, sub-processors etc. readily available at all times, regardless of the risk of the processing. That covers the whole chain, not only a vendor's direct subprocessors.
What counts as an AI subprocessor?
In a subprocessors.fyi audit, an AI subprocessor is any entity whose stated purpose is to provide, host or run AI models, including model providers, inference hosts and AI agent services. Each flag shows the vendor's own purpose wording, so you can see why it was flagged.
Does the audit include ongoing monitoring?
No. The $490 USD Vendor Chain Audit is a one-off snapshot with the date of each check. If you want to be alerted when a list in your chain changes, monitoring is a separate service at $99 USD per month for up to 100 vendors.
How is the audit different from Third Party Index's free DORA export?
Third Party Index's free DORA draft lays out a vendor's declared chain in EBA B_05.02 column order, but it covers ranks 1 and 2 only and marks every row as a candidate to check before it goes in a register. The Vendor Chain Audit goes to tier 3 and checks each row against the vendor's own list.
What happens if a vendor doesn't publish a subprocessor list?
We mark that vendor as 'not published' in the chain, with the date we looked, and list it as a gap so you know where to ask the vendor directly. We don't guess entries.
Is the Vendor Chain Audit legal advice?
No. It is an evidence-backed map of what vendors publish about their subprocessors. It does not review contracts or give legal advice; your DPO or counsel decides what to do with it.
Want to see a sample first?
The sample audit for Microsoft 365 Copilot is on this site.
$490, one-off
Request an invoice
Card payment isn't live yet, so we invoice you. We reply by plain-text email from founders@subprocessors.fyi.
No payment is taken on this page. We use these details only to invoice you. See our privacy notice.
Some public data on this site comes from Third Party Index, licensed CC BY 4.0. We add our own checks and AI flags. Third Party Index does not endorse subprocessors.fyi.